6b6a3b26586a1529e00317bf6bb3e93768132cfa77a0a0b9548657e5bad6461a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.1.0.41.exe
Size 40.5MB
Sample260813-etdt2agg49
SHA256 6b6a3b26586a1529e00317bf6bb3e93768132cfa77a0a0b9548657e5bad6461a
MD5 49f377be2c41d4f9d30f1a67ad394ffa
SHA1 5f03d37ffac8d0a83a3f7e42d4f39bb5fa7b2486
SHA512 5d7d949d2de67925d1c86fe2157bcc6b7e4f6f6e29fa75031d1b29ff98364a24c50f11dfd3849ce0cbc5b54e2e0a257def327fa7aff498e9b6168a3d1b43643a
SSDEEP 98304:nu/9nmRrRF3xMz1HbbXZ53M2Q5IU9DB1HbbXZ53M2Q5IUpAerZ:uFnmRrbuh7c2QHdh7c2Q3Aet
TLSH
T17A97734AB711CD49D123A239545B9F90E372EDB187B1936333B57B2D2EFA38C8DA2144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	v4yHOg.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\WSwM0w = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	v4yHOg.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	xicMTX.exe

Executes dropped EXE 6 IoCs

pid	Process
3272	xicMTX.exe
4496	xicMTX.exe
2424	v4yHOg.exe
3288	v4yHOg.exe
4756	AbCRi.exe
4496	LpS85v5G.exe

Loads dropped DLL 5 IoCs

pid	Process
3272	xicMTX.exe
4496	xicMTX.exe
2424	v4yHOg.exe
3288	v4yHOg.exe
4756	AbCRi.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4560	icacls.exe
1588	icacls.exe
1504	icacls.exe
3808	icacls.exe
4244	icacls.exe
2780	icacls.exe
4176	icacls.exe
3064	icacls.exe
2552	icacls.exe
1108	icacls.exe
628	icacls.exe
4428	icacls.exe
4048	icacls.exe
4168	icacls.exe
4600	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\WSwM0w\\xicMTX.exe\""	xicMTX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\v4yHOg\\v4yHOg.exe\""	v4yHOg.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4724	cmd.exe
4384	cmd.exe
4500	cmd.exe
5108	cmd.exe
4792	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	xicMTX.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\v4yHOg\XPSPLOG.dll	xicMTX.exe
File created	C:\Program Files (x86)\v4yHOg\thumbs.db	xicMTX.exe
File opened for modification	C:\Program Files (x86)\v4yHOg\thumbs.db	xicMTX.exe
File created	C:\Program Files (x86)\BAFBCFd\image.png	v4yHOg.exe
File opened for modification	C:\Program Files (x86)\BAFBCFd\thumbs.db	v4yHOg.exe
File opened for modification	C:\Program Files (x86)\v4yHOg	xicMTX.exe
File created	C:\Program Files (x86)\v4yHOg\v4yHOg.exe	xicMTX.exe
File opened for modification	C:\Program Files (x86)\v4yHOg\v4yHOg.exe	xicMTX.exe
File opened for modification	C:\Program Files (x86)\v4yHOg\XPSPLOG.dll	xicMTX.exe
File opened for modification	C:\Program Files (x86)\BAFBCFd\image.png	v4yHOg.exe
File created	C:\Program Files (x86)\BAFBCFd\thumbs.db	v4yHOg.exe
File created	C:\Program Files (x86)\BAFBCFd\AbCRi.exe	v4yHOg.exe
File opened for modification	C:\Program Files (x86)\BAFBCFd\AbCRi.exe	v4yHOg.exe
File created	C:\Program Files (x86)\BAFBCFd\XPSPLOG.dll	v4yHOg.exe
File opened for modification	C:\Program Files (x86)\BAFBCFd\XPSPLOG.dll	v4yHOg.exe
File created	C:\Program Files (x86)\v4yHOg\image.png	xicMTX.exe
File opened for modification	C:\Program Files (x86)\v4yHOg\image.png	xicMTX.exe
File opened for modification	C:\Program Files (x86)\BAFBCFd	v4yHOg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	v4yHOg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	v4yHOg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	v4yHOg.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
948	cmd.exe
5060	cmd.exe
4896	cmd.exe
3008	cmd.exe
3448	cmd.exe
5048	cmd.exe
3708	cmd.exe
4052	cmd.exe
2876	cmd.exe
2628	cmd.exe
2444	cmd.exe
896	cmd.exe
3796	cmd.exe
1856	cmd.exe
4648	cmd.exe
912	cmd.exe
3968	cmd.exe
1176	cmd.exe
3524	cmd.exe
2984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AbCRi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LpS85v5G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4yHOg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4yHOg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	v4yHOg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	v4yHOg.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "0"	v4yHOg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	v4yHOg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	v4yHOg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE	v4yHOg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xicMTX.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe
4352	schtasks.exe
1740	schtasks.exe
3904	schtasks.exe
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
1224	install.1.0.41.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe
3272	xicMTX.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	LpS85v5G.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 5108	3272	xicMTX.exe	103
PID 3272 wrote to memory of 4792	3272	xicMTX.exe	107
PID 5108 wrote to memory of 3904	5108	cmd.exe	109
PID 4792 wrote to memory of 3144	4792	cmd.exe	110
PID 5108 wrote to memory of 3140	5108	cmd.exe	111
PID 3272 wrote to memory of 4724	3272	xicMTX.exe	114
PID 5108 wrote to memory of 2264	5108	cmd.exe	115
PID 4792 wrote to memory of 2132	4792	cmd.exe	117
PID 4724 wrote to memory of 2332	4724	cmd.exe	118
PID 4792 wrote to memory of 4760	4792	cmd.exe	119
PID 3272 wrote to memory of 4384	3272	xicMTX.exe	120
PID 3272 wrote to memory of 4500	3272	xicMTX.exe	123
PID 4724 wrote to memory of 2108	4724	cmd.exe	125
PID 4384 wrote to memory of 4352	4384	cmd.exe	126
PID 4500 wrote to memory of 1740	4500	cmd.exe	127
PID 4724 wrote to memory of 1000	4724	cmd.exe	128
PID 4500 wrote to memory of 812	4500	cmd.exe	129
PID 4384 wrote to memory of 4004	4384	cmd.exe	130
PID 4384 wrote to memory of 1200	4384	cmd.exe	132
PID 4500 wrote to memory of 4880	4500	cmd.exe	133
PID 3708 wrote to memory of 628	3708	cmd.exe	136
PID 4052 wrote to memory of 4372	4052	cmd.exe	137
PID 3272 wrote to memory of 2424	3272	xicMTX.exe	138
PID 2424 wrote to memory of 912	2424	v4yHOg.exe	143
PID 2424 wrote to memory of 2984	2424	v4yHOg.exe	144
PID 2424 wrote to memory of 3968	2424	v4yHOg.exe	147
PID 2424 wrote to memory of 1176	2424	v4yHOg.exe	149
PID 2424 wrote to memory of 2876	2424	v4yHOg.exe	152
PID 2984 wrote to memory of 4168	2984	cmd.exe	154
PID 2424 wrote to memory of 2628	2424	v4yHOg.exe	155
PID 2628 wrote to memory of 4244	2628	cmd.exe	157
PID 2424 wrote to memory of 4700	2424	v4yHOg.exe	158
PID 4700 wrote to memory of 4176	4700	cmd.exe	160
PID 2424 wrote to memory of 948	2424	v4yHOg.exe	161
PID 948 wrote to memory of 4600	948	cmd.exe	163
PID 2424 wrote to memory of 1856	2424	v4yHOg.exe	164
PID 1856 wrote to memory of 628	1856	cmd.exe	166
PID 2424 wrote to memory of 5060	2424	v4yHOg.exe	167
PID 5060 wrote to memory of 4560	5060	cmd.exe	169
PID 2424 wrote to memory of 2444	2424	v4yHOg.exe	170
PID 2444 wrote to memory of 2780	2444	cmd.exe	172
PID 2424 wrote to memory of 4648	2424	v4yHOg.exe	173
PID 4648 wrote to memory of 3064	4648	cmd.exe	175
PID 2424 wrote to memory of 896	2424	v4yHOg.exe	176
PID 896 wrote to memory of 2552	896	cmd.exe	178
PID 2424 wrote to memory of 3524	2424	v4yHOg.exe	179
PID 3524 wrote to memory of 4428	3524	cmd.exe	181
PID 2424 wrote to memory of 3796	2424	v4yHOg.exe	182
PID 3796 wrote to memory of 1588	3796	cmd.exe	184
PID 2424 wrote to memory of 4896	2424	v4yHOg.exe	185
PID 4896 wrote to memory of 4048	4896	cmd.exe	187
PID 2424 wrote to memory of 3008	2424	v4yHOg.exe	188
PID 3008 wrote to memory of 1108	3008	cmd.exe	190
PID 2424 wrote to memory of 3448	2424	v4yHOg.exe	191
PID 2424 wrote to memory of 5048	2424	v4yHOg.exe	194
PID 5048 wrote to memory of 3808	5048	cmd.exe	196

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	v4yHOg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	v4yHOg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.1.0.41.exe
"C:\Users\Admin\AppData\Local\Temp\install.1.0.41.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224

C:\Users\Public\WSwM0w\xicMTX.exe
C:\Users\Public\WSwM0w\xicMTX.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WSwM0w\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WSwM0w\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4880
- C:\Program Files (x86)\v4yHOg\v4yHOg.exe
  "C:\Program Files (x86)\v4yHOg\v4yHOg.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\v4yHOg.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\v4yHOg\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3808

C:\Users\Public\WSwM0w\xicMTX.exe
"C:\Users\Public\WSwM0w\xicMTX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4496

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WSwM0w" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WSwM0w" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:628

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1300

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4372

C:\Program Files (x86)\v4yHOg\v4yHOg.exe
"C:\Program Files (x86)\v4yHOg\v4yHOg.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3288

C:\Program Files (x86)\BAFBCFd\AbCRi.exe
"C:\Program Files (x86)\BAFBCFd\AbCRi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4756

C:\ProgramData\LpS85v5G.exe
C:\ProgramData\LpS85v5G.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\BAFBCFd\XPSPLOG.dll
Size 4.6MB
SHA256 67f606f83d575d52326dc85b80f22c568f8fe2a607acd1e613cc36eea93a90e0
MD5 9b412254bf7237f8e2bacd50cebdd08d
SHA1 15745f9c2dd224616e2969c32c9f623680bbca04
SHA512 d1910d36a0362bd1d9ee4f8d4fb639824e444dcad4df30013ec0bc73ce24b5beb40237658a647ab0019db9c6b528109fed12f6a2248cd8b8fbdff0cf1f3712a3
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyQ:BMWKfU+BcUTHCCCfqCiUffnQ
TLSH
T184263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\BAFBCFd\image.png
Size 5.0MB
SHA256 caa5dd8d512f2bb217132c4647dfdc852db72a3854a9d03fded1108408e7dd23
MD5 d853ed2bbf1c33dcae348b66f6f6fbe8
SHA1 e9b9d5b6a261a5a9e3b281f5991f8afdf3a39bbf
SHA512 5ec4f0069034aa83dbda5ad03163f41847abff89322c88ff5e2aaa69cd10f80e680303b0d6102b3d3342dd58173a995573e7902077274745074e1073508a4ce7
SSDEEP 98304:IqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:c/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T19A363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\v4yHOg\XPSPLOG.dll
Size 4.6MB
SHA256 62597603c867bdbb079bcf139a3ea8ca0fc423d3d5955477ae4a6d15cad4591e
MD5 59bc75d9d8392121fac2435514271f0b
SHA1 290b974d106908e9dcfddd46b7df998a36db9c8a
SHA512 4f7e82b70c722c19dba71f2da27de33bb116c9e9173904cd1467c4bd12461585da40bb30184fd5adfeff10a4dc33c2bfcf37d6ef5db7429690d276b68198d246
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyv:BMWKfU+BcUTHCCCfqCiUffnv
TLSH
T1B1263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\v4yHOg\image.png
Size 5.0MB
SHA256 8df59e6caf796c0f9e9837ef6b61fc33e576e1c61477c5a86735938b0fcdd548
MD5 4c07f0b5aa0615a52531f326bb2febb4
SHA1 d1810aa8f66a501459ef048e13784b1c5daac99c
SHA512 292e9282e57a4045a4f54bfa74e1caff7f5c07d723f41f8271bbfe7ffd63ef664998dbed87824b2805f5fbab2b70701dedc68a5eacfa5cca026afa088626bfae
SSDEEP 98304:9qvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:1/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T1F2363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\v4yHOg\thumbs.db
Size 358KB
SHA256 f30a4c2e0f78444b0a96471c886067359675d06d5d8f759f43eb8d137d3c4e96
MD5 00293ac43392dcd9fa7b34199117d607
SHA1 f74b9a527b6b105304b1c5e1825b14d5fcd9ef0e
SHA512 a5ec327dfe271ad8274ecd3216092fe86d195ac4425925b3f4af9752065d178f8ed5379457a5818c600c8c6e5c3e88e96ee47c28da33f0f79c16a242fa351b3e
SSDEEP 6144:PiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:68u69CghoQxoMTFQqtKFCz7mb/
TLSH
T13474F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v4yHOg.exe

Path C:\Program Files (x86)\v4yHOg\v4yHOg.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LpS85v5G.exe

Path C:\ProgramData\LpS85v5G.exe
Size 2.8MB
SHA256 5c6ff80bd3203cf5a895d7008c6a425d1b8f22dff5745bd5f4dbc7b88e06650d
MD5 ae720378cc07a441273308b3a68a4715
SHA1 791632110e9644eccad328ce904590a83e005ec2
SHA512 41d15e57e39e78db2f2c21e12423c5e8e620e3df8bda97eecb3a311092eee5b854c35366d20e7df368cb86de8d26cf546f5f61f55a82c64f7fefc1760e8e304b
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+TpX:igu9hviynj8Ip+nxVEenv4iQQVkEJ
TLSH
T18FD523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 154e804f32db02091ea521ae53b8ae80818b05e8a7b9d95f84b92821f9027b89
MD5 de88f879f74e12fde6465d4dec91b360
SHA1 541197bdb570f7aeb385a2fd1dd99d46202f27df
SHA512 43f221c6628237d2febbfcf8c7fbc845a9c0bfce3872579ed085e8fefc0ae79e7e62ee04c39a223544d3b0645957e7b4be5780578b6e7c42cd0450254f240048
TLSH
T1102119964EB69A90BF816E5722C5CD3A7DE737C088AC140D923958CB2C313A5BF1290A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 586db554f45c6e46ee8ca3d05458f93f613f625ab892b2cbb0468d55c3dffd5d
MD5 8fb053635635b1e25701f5a586b5ee18
SHA1 cd287e7c1c211393cf3ad2c5b76e096da4d5ad73
SHA512 49b2ca019bb0f66b1abe0faef116469015f8fdcb06018293588c82d41246eaf7ad1634bd7aab1aa9b61af2f41bbf87ca95c07430a701563ffe7673907aa5e700
TLSH
T12E21968B176B25A3E362DD4518C4BE371CF19AD0549D0105701E83AA14103F6FA4E56A
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 2a4f63054fa8f12faa93f3affb6fe87f9cc98a62e15208692f834346e7e14bb6
MD5 b45e55888b56d60b12d55b03c4399631
SHA1 97e3880f5042168cf341afa373671d51588194cb
SHA512 3a885b35330145e97bb0286907eaa22a9af3e0020ef4357f1562438f7248dba9cf4984e7e007ec4835a21a9d71620e367409d5fc6c69157036c4eeff0fab691b
TLSH
T14921B6935C9E2D491B08EC9E5883C7F32F71E4DB9A9476502032509CA9583C3EF0C58B
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 8fdd0d535d206ae335d52ce1229741e966e79d32c7d5f2fa6e0ca08e6c614071
MD5 3e9eda39eb8e7933a31b78edd0ef0ba2
SHA1 4ca18ce0da39fa510f0fcc01ac0cfdbee4a8cd71
SHA512 b4bcc5711f6d4054a34209e9451efb8fa3f687c6cb14ee61027c0e3dcc45bda5bb377784aebc78da86264901b21c7f0b0d62e62088590d2b1a86298c68edbc9a
TLSH
T1B7F05C2C0EBA413EF171C9791ADD79B38A3BEB05210502E416E4C7086D0AF053C5163D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 60eb682a88d007d8e2c96863c88e7058adf6c44fd27c254986445e0360ac7ab1
MD5 132bfac43e477bc25a2a254b8e8d6836
SHA1 98de0526a1a32e0a722af44617110e554fa7a16e
SHA512 e7626b48c58132f959d5a4de08cdba4e787359f83359c995d8bbd1d6ffc3eecffd35f5f2b77281ab75e6018b958484aadec17e025fae54bdca17da67381aad8b
TLSH
T170F05C2CAAF4E005F176CA7C19E62AF19E6BFA5319060FFE19A5525D6F20F002CC153D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 5c73e9f2f6d7dd315e77814bcf6b31ac7b57902a140be8b08af662f161221365
MD5 bfd2573fd69d0ed2e7799f701a2c5262
SHA1 b6c64f04e6643382d67193ae21f2716cc9278be7
SHA512 f184fd2f7379b7421c783d937667ee92f4282246fa291d25c61bdf167d2a38e2e5f9d75c19135feb9bf8b20b60cd9c63ddd3d5a4fa959c810523e6a8f7922788
TLSH
T11AF0D4286479805DF0B7D9341FD471365866F506F901465E0EB3C7287E56E016CD377D
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\WSwM0w\UxEnhance64.dll
Size 3.1MB
SHA256 0548b8c934111a4cbe26979be253550bfb2a335bec5263379e57e24511ac3c71
MD5 e3e3e738a22a663ad1fad47d469cc315
SHA1 e80edc6144e0104514157f7496749f0fee4c5fb3
SHA512 ff1b58c17bd16e2ccb15f073b5dffc9d7d4829aa0ce5f710a68a341b7eefdaf75e4b3a2f8195fe702a37bcb4a7dc3d8af86667434447b4bcbca5221635d9a19d
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+d:P9m29xx3Tiqt06ox6+z2rNNrKod
TLSH
T14BE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\WSwM0w\adoresd.dat
Size 4.7MB
SHA256 f5605d27e71c7be4fd3307a8a2142e3cca571dfb683b90559ecdbb77aca0d3db
MD5 eea2fadcc2ab90035a7c1005e19c818b
SHA1 49a3e023279ca990761ddb56ce606efdbfd405ec
SHA512 80ceba000329d1b6f410bf95a22c9a8ed68044f3ab7fb31fbbe0c9315e75b8300eb2eeec0101e50cd09ec9be2986e6ae6c7f1fc12a90b9aad01aad3176cd2785
SSDEEP 98304:3mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Wu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1873633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF074145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\WSwM0w\msadox.tb
Size 8KB
SHA256 3f89a45c10c0bff1ef53777f6540f8525fb5cb9bfc06902f7fef6b499e529f3d
MD5 140f36fd6f6cdfe97efd857409fce6f0
SHA1 aca924a8f6162ebac112394732a2db92702029f6
SHA512 dbae21ce2bd31776af9a4dc3ecbd62f32b39089d9ef75d40a92b149fe9b18c10d84cbbfb3ff0e6d5bb94567ada38057a3e72289b0f15830edf7c7722a51aab32
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T1F1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xicMTX.exe

Path C:\Users\Public\WSwM0w\xicMTX.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1224-525-0x00007FFFAA950000-0x00007FFFAA960000-memory.dmp

Download

memory/1224-504-0x00007FFFAA950000-0x00007FFFAA960000-memory.dmp

Download

memory/1224-2-0x00000000005D0000-0x00000000005DC000-memory.dmp

Download

memory/1224-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/1224-1-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/1224-524-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/2424-754-0x0000000004FC0000-0x0000000004FF1000-memory.dmp

Download

memory/2424-702-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2424-697-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-685-0x0000000005530000-0x0000000005544000-memory.dmp

Download

memory/2424-675-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-678-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-750-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-673-0x00000000017C0000-0x00000000017C1000-memory.dmp

Download

memory/2424-671-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-751-0x0000000003AB0000-0x00000000042B7000-memory.dmp

Download

memory/2424-668-0x00000000745A0000-0x0000000074CEA000-memory.dmp

Download

memory/2424-666-0x0000000001790000-0x0000000001791000-memory.dmp

Download

memory/2424-764-0x0000000009290000-0x00000000092C1000-memory.dmp

Download

memory/3272-550-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-558-0x000001F7536B0000-0x000001F75373A000-memory.dmp

Download

memory/3272-530-0x00007FFFB3950000-0x00007FFFB3952000-memory.dmp

Download

memory/3272-531-0x00007FFF95E60000-0x00007FFF9637E000-memory.dmp

Download

memory/3272-536-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-538-0x00007FFFB3960000-0x00007FFFB3962000-memory.dmp

Download

memory/3272-539-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-543-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-544-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-546-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-565-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-563-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-555-0x000001F751F90000-0x000001F751FDE000-memory.dmp

Download

memory/3272-545-0x000001F752A40000-0x000001F7532D1000-memory.dmp

Download

memory/3272-559-0x000001F7536B0000-0x000001F75373A000-memory.dmp

Download

memory/3272-557-0x000001F7536B0000-0x000001F75373A000-memory.dmp

Download

memory/3272-556-0x000001F7536B0000-0x000001F75373A000-memory.dmp

Download

memory/3288-718-0x0000000002E40000-0x0000000003647000-memory.dmp

Download

memory/3288-730-0x0000000002E40000-0x0000000003647000-memory.dmp

Download

memory/3288-734-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3288-729-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/3288-711-0x00000000745A0000-0x0000000074CEA000-memory.dmp

Download

memory/3288-710-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/4496-591-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4496-592-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4496-772-0x0000000000AB0000-0x0000000000F71000-memory.dmp

Download

memory/4496-594-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4496-595-0x00007FFFB3950000-0x00007FFFB3952000-memory.dmp

Download

memory/4496-593-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4496-586-0x00007FFFB3960000-0x00007FFFB3962000-memory.dmp

Download

memory/4496-579-0x00007FFF95E60000-0x00007FFF9637E000-memory.dmp

Download

memory/4496-582-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4496-587-0x0000019A7A520000-0x0000019A7ADB1000-memory.dmp

Download

memory/4756-746-0x0000000003450000-0x0000000003C57000-memory.dmp

Download

memory/4756-727-0x0000000003450000-0x0000000003C57000-memory.dmp

Download

memory/4756-722-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/4756-723-0x00000000732C0000-0x0000000073A0A000-memory.dmp

Download

memory/4756-749-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/4756-745-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download